CAN-SPAM Act

Also called: CAN-SPAM, Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003.

CAN-SPAM is an opt-out law: you can send commercial email without prior consent, but every message must follow the FTC's rules. Don't use false or misleading headers or deceptive subject lines; identify ads as ads; include a valid physical postal address; tell people how to opt out; and honor opt-outs within 10 business days. The opt-out has to keep working for at least 30 days after you send.

The FTC is explicit that the law "makes no exception for business-to-business email," so B2B cold email to local businesses is fully covered. You also can't hand the responsibility to someone else: both the company being promoted and the company sending the email can be held responsible.

Penalties are per email. The FTC states each separate violating email is subject to penalties of up to $53,088, the inflation-adjusted figure in effect since January 17, 2025. There was no 2026 increase, because the 2026 federal penalty inflation adjustment was cancelled.

CAN-SPAM only covers the US. If your list includes Canada, the UK, the EU or Australia, stricter rules apply to those recipients.

Example

An agency's cold email to Phoenix roofers includes the sender's real name, an honest subject, the agency's registered P.O. box, and "Reply 'no' and I won't email again." Replies saying no are suppressed the same day.